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(54) DECODING METHOD AND ELECTRONIC APPARATUS 

(57)Abstract: 

PROBLEM TO BE SOLVED: To make it possible to complete all of decoding 
processing in real time on a reception side. 

SOLUTION: PID information and TSC information are extracted from the inside of the 
header of the reception data inputted to a terminal 1 and are supplied to an IDT 
(inter-data key retriever) 16. This IDT 16 receives such information and searches and 
reads out data keys out of a DPMEM(dual port memory) 1 7 by an indirect retrieval 
method. The plural data keys updated at every prescribed period are written 
asynchronously in the DPMEM 17. The writing of the DPMEM 17 is prohibited when 
the writing and reading out of the DPMEM are simultaneously executed with the same 
address at the same timing. As a resultthe easy memory control of the DPMEM 1 7 is 
made possible. 
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CLAIMS 



[Claim(s)] 

[Claim 1]A write-in step which writes two or more key information in a memory 
meansand a read-out step which shifts and reads that key information from said 
memory means to be directed using information in input dataConsist of a 
decipherment step which decodes said input data based on key information read at 
this read-out stepand A period of implementation of said write-in stepA decoding 
method which is a case where a period of implementation of said read-out step 
lapsand is characterized by forbidding execution of said write-in step when a writing 



address and a reading address are in agreement. 

[Claim 2]A read-out step which is based on indicative data in input datashiftsand 
reads that key information from a memory means which has memorized two or more 
key informationConsist of a decipherment step which decodes said input data based 
on key information read at this read-out stepand in said read-out step. Key 
information read from said memory means by referring to a key table with said 
indicative data is searchedA decoding method choosing fewest key addresses when a 
key address for reading said key information applicable to said indicative data exists in 
said two or more key tables. 

[Claim 3]By having the following and referring to a table with said indicative data in 

said read-out stepA decoding method having searched a key address of key 

information read from said memory meansand searching a key address when a key 

address referred to with said indicative data does not exist in said table. 

A read-out step which is based on indicative data in input datashiftsand reads that 

key information from a memory means which has memorized two or more key 

information. 

A decipherment step which decodes said input data based on key information read at 
this read-out step. 

[Claim 4]By having the following and referring to a key table with said indicative data 
in said read-out stepA decoding method characterized by carrying out initial 
processing in said initial step so that there may be no applicable key addressas a 
result of searching a key address of key information read from said memory means 
and searching within an initialization period. 
An initial step which performs initial setting. 

A write-in step which writes two or more key information in a memory means. 

A read-out step which is based on indicative data in input datashiftsand reads that 

key information from said memory means. 

A decipherment step which decodes said input data based on key information read at 
this read-out step. 

[Claim 5]Electronic equipment provided with a decoding means which performs a 
decoding method according to claim 1 at least. 

[Claim 6]Electronic equipment provided with a decoding means which performs a 
decoding method according to claim 2 at least. 

[Claim 7]Electronic equipment provided with a decoding means which performs a 
decoding method according to claim 3 at least. 

[Claim 8]Electronic equipment provided with a decoding means which performs a 
decoding method according to claim 4 at least. 



DETAILED DESCRIPTION 



[Detailed Description of the Invention] 
[0001] 

[Field of the Invention]It is enciphered in this invention. 

Thereforein response to the send data by which scramble was carried outit is related 
with the decoding method and electronic equipment which were decoded. 

[0002] 

[Description of the Prior Art]In order to keep the information in communication 
secretthe encryption and the decoding method which acquired the original information 
are known from the former by enciphering transmit informationand receiving and 
decoding the enciphered transmit information. Cryptographic algorithmssuch as DES 
(Data Encryption Standard) which is a standard method in the U.S. as such encryption 
and a decoding methodare known. 

[0003]By the waythere are a variety and various things in a cryptographic 
algorithmand the method which was more excellent in safety and rapidity is developed. 
As this examplethe cipher system (MULTI2 method) indicated to the US4982429B 
Descriptionthe US5103479B DescriptionJPH1-276189Aetc. is known. There are a 
cipher system registered as ISO9979/0009 also in International Organization for 
Standardization (ISO) and encryption use mode registered as ISO/IEC1 01 1 6. 
[0004]In the cipher system of the MULTI2 above-mentioned methodinput data size 
shall be 64 bitsoutput data size is 64 bitsand the work key of 256 bit sizes required in 
order to perform encryption is generated from the system key of 256 bit sizeand a 
64-bit data key. Let the encryption number of stages be a positive integer stage. The 
outline composition of the encryption algorithm in this MULTI2 method is shown in 
drawing 1 7 . MULTI2 method generates the 256-bit work key Kw by using 256-bit 
system key J for the 64-bit data key Ksand calculating a cryptographic algorithmas 
shown in drawing 1 7 . The operation of this cryptographic algorithm is performed by 
the cryptographic algorithm execution means C. The 64-bit plaintext which the 
generated work key Kw was supplied to the cryptographic algorithm execution means 
Fand was inputted is enciphered. The cryptographic algorithm performed by the 
cryptographic algorithm execution means C and the cryptographic algorithm execution 
means F is the same cryptographic algorithm. 

[0005]Although such encryption is a fundamental encryption algorithm of MULTI2 
methodNowthere is a possibility that a plaintext may be presumedby carrying out the 
statistical work of the distribution of the frequency where a character or a word 
appears beforehandand taking matching with the frequency distribution of the 
character string pattern of the encryption sentence which came to hand. Thenthere is 
the technique of calculating the exclusive OR of the enciphered 64 bits code block 
and the 64-bit input data inputted into the nextand creating a cryptogram. The mode 



which performs this technique and is enciphered is read with the CBC (Cipher Block 
Chaining) mode. The cryptographic algorithm in such CBC mode is performed in the 
above mentioned cryptographic algorithm execution means F. 
[0006]Although there is a communication method with which the unit of the data 
which communicatesfor example like packet communication is decided 
beforehandwhen the data unit which cannot be divided among the number of bits of 1 
block is inputteddata comes to remain in a block cipher system which makes 64 bits 1 
block. Thenhe is trying to process the fraction process in OFB (Output Feedback) 
mode. In this OFB modethe fractional part of data is supplied to the cryptographic 
algorithm execution means Gand is enciphered using a random number. This random 
number is generated by the cryptographic algorithm execution means G using the 
work key Kw. Therebythe cryptogram which makes 64 bits 1 block can be acquired 
now. The CBC mode and OFB mode are called encryption use mode. 
[0007]The outline composition of the decoding algorithm in MULTI2 method is shown 
in drawing 1 8 . As shown in drawing 1 8t he 256-bit work key Kw is generated by using 
256-bit system key J for the 64-bit data key Ksand calculating a cryptographic 
algorithm. The operation of this cryptographic algorithm is performed by the 
cryptographic algorithm execution means c. Decoding of the 64-bit cryptogram which 
the generated work key Kw was supplied to the decipherment algorithm execution 
means fand was inputted is carried out. The cryptogram enciphered in OFB mode is 
supplied to the cryptographic algorithm execution means gand decoding is carried out 
by using the random number generated by the cryptographic algorithm execution 
means g using the work key Kw. Therebydecoding of the 1 -block 64-bit cryptogram 
can be carried outand a 64-bit plaintext can be obtained. When considered as the 
CBC modeit is made for the decipherment algorithm execution means f to have a 
decipherment algorithm in the CBC mode performed. 

[0008]Herealthough explanation of encryption use mode is given referring to drawing 
l£the outline composition of encryption and decoding of the CBC mode is shown in 
drawing 1 9 (a)and the outline composition of encryption and decoding of OFB mode is 
shown in drawing 1 9 (b). In the CBC modeas shown in drawing 19 (a)i-th plaintext 
block M(i) is inputted into the exclusive "or" circuit 101 and exclusive OR with 
ciphertext block C (i-1) in front of 1 block delayed with the register (REG) 103 
calculates it. The calculated data is enciphered in the cryptographic algorithm 
execution means 102 by the work key generated based on the data key Ks. This 
enciphered i-th ciphertext block C(i) is C(i)=EKs (M(i) .EOR.C (i-1)). 
It can express. Howeverit means that EKs (m) enciphers m by Ksand it is shown that 
EOR calculates exclusive OR. 

[0009]And it will be transmitted and this ciphertext block C(i) will be received in a 
receiver. Received ciphertext block C(i) is decoded using the work key generated 
based on the data key Ks in the decipherment algorithm execution means 1 1 land is 
supplied to the exclusive **** circuit 113. Ciphertext block C (i-1) in front of 1 block 



delayed in the register (REG) 1 12 is inputted into this exclusive "or" circuit 1 13and 
both exclusive **** calculates. At this timethe data key Ks of the transmitting side 
and a receiver is equalandtherebyi-th plaintext block M(i) is decoded from the 
exclusive "or" circuit 113. hth plaintext block M(i) can be expressed as follows. 
M(i) =DKs(C(i) .EOR.CG-1)) 

Howeverit is shown that DKs (c) carries out decoding of the c by Ks. 
[0010]In the time of OFB modei-th plaintext block M(i) is supplied to the exclusive 
"or" circuit 105. The output of the cryptographic algorithm execution means 104 
random-number-ized by the work key generated based on the data key Ks is supplied 
to this exclusive "or" circuit 105. 1 block of outputs of the cryptographic algorithm 
execution means 1 04 are delayed with the register 1 03and are returned to the 
cryptographic algorithm execution means 104. Therebyfrom the exclusive "or" circuit 
105ciphertext block C(i) enciphered with the random number is outputted. 
[001 1]And it will be transmitted and this ciphertext block C(i) will be received in a 
receiver. Received ciphertext block C(i) is supplied to the exclusive **** circuit 114. 
The output random-number-ized using the work key generated based on the data key 
Ks in the cryptographic algorithm execution means 1 1 5 is supplied to this exclusive 
**** circuit 114. 1 block of outputs of this cryptographic algorithm execution means 
1 15 are delayed in the register (REG) 1 12and are returned to the cryptographic 
algorithm execution means 1 1 5. In this casethe random number supplied to the 
exclusive "or" circuit 1 14 is equal to the random number supplied to the exclusive 
"or" circuit 1 05andtherebyi-th plaintext block M(i) is obtained from the exclusive "or" 
circuit 114. 

[0012]The outline composition of the encryption and the decoding method which has 
the encryption use mode explained above is shown in drawing 20 . In this figurethe 
transmitting side is equipped with the scrambler 100and the scramble of the input 
data is carried out by the scrambler 100and it is transmitted. The transmission line of 
space etc. is spread by this send data by which scramble was carried outand it is 
received by a receiver. The receiver is equipped with the descrambler 110. 
The send data scramble was carried out [ send data ] by this descrambler 1 10 is 
descrambledand it comes to be returned and outputted to the original data. 

[0013]Encryptor 102 which is a cryptographic algorithm execution means which 
enciphers the input data (plaintext) into which the scrambler 100 was inputtedlt 
comprises an OFB mode encryption section set to the register 103the CBC mode 
encryption section which consists of the exclusive "or" circuit (EX-OR) 101 and 
Encryptor 104 which are cryptographic algorithm execution means from the exclusive 
"or" circuit (EX-OR) 105. It has Encryptor 106 which generates a work key from a 
data key and a system key in the scrambler 100. The generated work key is supplied 
to Encryptor 102104. By the waysince Encryptor 102Encryptor 104and Encryptor 106 
are made into the identical configurationthree Encryptor(s) can be made to serve a 



double purpose by one Encryptor. Since operation of the CBC mode encryption 
section and an OFB mode encryption section is as having mentioned aboveit is 
omitted here. 

[0014]Decryptor 111 which is a decipherment algorithm execution means by which 
the descrambler 1 1 0 carries out decoding of the inputted received data (cryptogram)It 
comprises an OFB mode decoding part set to the register 1 12the CBC mode 
decoding part which consists of the exclusive "or" circuit (EX-OR) 113and Encryptor 
1 1 5 which are cryptographic algorithm execution means from the exclusive "or" 
circuit (EX-OR) 1 14. It has Encryptor 116 which generates a work key from a data 
key and a system key in the descrambler 110. The generated work key is supplied to 
Decryptor 1 1 1 and Encryptor 1 1 5. Since Encryptor 1 1 5 and Encryptor 1 1 6 are made 
into the identical configurationtwo Encryptor(s) can be made to serve a double 
purpose by one Encryptor. Since operation of the CBC mode decoding part and an 
OFB mode decoding part is as having mentioned aboveit is omitted here. 
[0015] 

[Problem(s) to be Solved by the Invention]By the waywhen realizing and using 
advanced encryption and decoding method like MULTI2 method mentioned above by 
softwarea real-time operation cannot be performed in the computing speed of the 
present calculating means, that iswhen it appliesfor example to satellite digital 
television broadcast etc.decoding processing [ in / for a picture or a sound / a 
receiver since / without ******** / it is necessary to come out and carry out real- 
time reproduction ] must be performed by the possible hardware of high-speed 
processing. Howeverthe hardware which can complete all the decipherment 
processings in real time in a receiver had the problem of becoming large-sized from 
performing complicated processing. 

[0016]Thenthis invention sets it as the 1st purpose to provide the decoding method 
which can complete all the decipherment processings for the data by which scramble 
was carried out with the advanced cipher system using small and cheap hardware in a 
receiver in real time. This invention sets it as the 2nd purpose to provide small and 
cheap electronic equipment provided with the decoding means which can complete all 
the decipherment processings for the data by which scramble was carried out with 
the advanced cipher system in real time in a receiver. 
[0017] 

[Means for Solving the Problem]In order to attain the 1st purpose of the abovea 
decoding method of this inventionA write-in step which writes two or more key 
information in a memory meansand a read-out step which shifts and reads that key 
information from said memory means to be directed using information in input 
dataConsist of a decipherment step which decodes said input data based on key 
information read at this read-out stepand A period of implementation of said write-in 
steplt is a case where a period of implementation of said read-out step lapsand when 
a writing address and a reading address are in agreementhe is trying to forbid 



execution of said write-in step. 

[0018]In order to attain the 1st purpose of the aboveother decoding methods of this 
inventionA read-out step which is based on indicative data in input datashiftsand 
reads that key information from a memory means which has memorized two or more 
key informationConsist of a decipherment step which decodes said input data based 
on key information read at this read-out stepand in said read-out step. Key 
information read from said memory means by referring to a key table with said 
indicative data is searchedWhen a key address for reading said key information 
applicable to said indicative data exists in said two or more key tableshe is trying to 
choose fewest key addresses. 

[0019]In order to attain the 1st purpose of the abovefurther again a decoding method 
of further others of this inventionA read-out step which is based on indicative data in 
input datashiftsand reads that key information from a memory means which has 
memorized two or more key informationConsist of a decipherment step which 
decodes said input data based on key information read at this read-out stepand in 
said read-out step. A key address of key information read from said memory means 
by referring to a table with said indicative data is searchedand when a key address 
referred to with said indicative data does not exist in said key tableit is made not to 
search a key address. 

[0020]In order to attain the 1st purpose of the abovefurther again a decoding method 
of further others of this inventionAn initial step which performs initial settingand a 
write-in step which writes two or more key information in a memory meansA read-out 
step which is based on indicative data in input datashiftsand reads that key 
information from said memory meansConsist of a decipherment step which decodes 
said input data based on key information read at this read-out stepand in said read- 
out step. A key address of key information read from said memory means by referring 
to a key table with said indicative data is searchedand as a result of searchingin said 
initial stepinitial processing is made to be carried out within an initialization period so 
that there may be no applicable key address. 

[0021 ]He is trying to provide at least electronic equipment of this invention which 
attains the 2nd purpose of the above with a decoding means which shifts and 
performs that decoding method to describe above further again. 

[0022]Since read-out and writing control of a memory means in which key information 
required in order to perform decipherment processing is stored can be performed 
appropriately according to a decoding method of such this inventionit can be 
considered as a decoding method that memory control can be performed easily. 
Thereforeit can be considered as a decoding method that all the decipherment 
processings can be performed in real time in a receiver. In electronic equipment 
provided with a decoding means which performs such a decoding methodsince 
composition of a memory control means can be simplifiedelectronic equipment can be 
provided small and cheaply. 



[0023] 

[Embodiment of the Invention]The block diagram showing the example of composition 
of the decipherment device which is an embodiment of the decoding method of this 
invention is shown in drawing 1 . In this figurethe decipherment device A The decoding 
part B in the CBC modeand the decoding part C in OFB mode. The data key indirect 
search machine (IDT) 1 6 provided with a packet ID (PID) tablelt comprises the 
comparator (COMP) 1 1 which compares with the writing address and reading address 
of DPMEM17 the dual port memory (DPMEM) 17 which passes the data key used for 
encryption of input data to the decoding parts B and C. 

[0024]The cryptogram data which is received data is inputted into the terminal 1 of 
the decipherment device Aand this cryptogram data is inputted into the means for 
switching 3. When [ both ] considered as the CBC mode at this timethe means for 
switching 3 and the means for switching 4 are switched to the terminal a sidedecoding 
of the inputted cryptogram data is supplied and carried out to the CBC mode 
decoding part Band it is outputted to it. When considered as OFB modeit is switched 
to the means for switching 3both the means for switching 4 are switched to the 
terminal b sideand cryptogram data is inputted into the OFB mode decoding part C 
side. And decoding of the inputted cryptogram data is carried out in the OFB mode 
decoding part Cand plaintext data is outputted. In the CBC mode decoding part B and 
the OFB mode decoding part Calthough decipherment processing of the inputted 
cryptogram data is carried out and it is considered as plaintext datathe decoding 
algorithm is the same as the decoding algorithm shown in said drawing 18 . A data key 
required for decipherment processing is supplied from DPMEM17 in this case. 
[0025] Let the format of the received data inputted into the terminal 1 be the 
transport stream (it is hereafter described as TS.) specifiedfor example as 
ISO/IEC13818. TS is made into 188 bytes of packet structureand he is trying for the 
pay load of 1 84 bytes to usually continue after 4 bytes of header. Since parity is 
added for the error correction to a transmission error16 bytes of straw-man period 
for parity is addedand it is considered as the stream of these repetitions. 
[0026]. [ whether the packet is constituted from picture image data by the header of 
this TSand ] The PID information which shows whether it comprises comprising voice 
data or other dataThe TSC (Transport Scrambling Control) flag etc. which show 
whether it is TS enciphered are containedand the attribute of these packets is 
interpreted by analyzing a header in the analyzing parts which are not illustrated. It is 
made to output TS as it is through a delay partwhen interpreted as the packet which 
is not enciphered by TSC at this timewithout performing decoding processing. The 
time delay of this delay part is made equal to the time which decipherment processing 
takes to the decipherment device A. 

[0027]To one PIDtwothe data key Kse (Ks_even) and the data key Kso (Ks_odd)are 
assigned. Since a data key is updated every [ several seconds thru/or ] tens of 
secondsthis needs to rewrite a data key so that it may be enough for updatingAnd it 



is because only one of these is usedand updating of the data key which is not used of 
the data key Kse and the data key Kso is enabled and they can update the data key 
at the time of decipherment processing. That isit is for performing easily updating 
control which updates a data key. Although said analyzing parts do not illustrateit 
prepares for the CBC mode decoding part Bfor exampleand PID/TSC information with 
a data size of 15 bits is sent to IDT16 from the CBC mode decoding part B. 
[0028]In IDT16read address RA (data size is 9 bits) of DPMEM17 is generated 
combining the address information read from PID with reference to the PID table 
using the PID information of 1 3 received bit sizesand the TSC information on 2 bit 
size. Generated read address RA was supplied to RA terminal of DPMEM1 7 from AO 
terminalit was controlled so that a lead enabling (RE) signal would be in an active 
state at this timeand it has read the data key applicable to read address RA from 
DPMEM17. The read data key is equal to the data key used at the time of encryption 
of inputted TSis outputted from terminal RD and supplied to Decryptor 5. Decryptor 5 
performs decipherment processing of the cryptogram data which generated the work 
key and was inputted based on the generated work key from the supplied data key 
and a different system key for every system. The system key is beforehand passed to 
the decipherment device A from CPU10. 

[0029]When you are trying to be written in DPMEM17 and it writes in the data key 
which is needed in the decoding parts B and C and which is updated before CPU10 is 
needed in decipherment processingWrite enable (WE) is made into an active stateand 
the write data (WD) of a write address (WA) with a data size of 9 bits and a data key 
with a data size of 8 bits is supplied to DPMEM17. In this caseCPU10 is equipped with 
ROM or RAM and the data given to the decipherment device A is written in these 
memories. Since the read data becomes unfixed when writing data key information in 
DPMEM17 and IDT16 comes to read a data key with the same read address as a 
write addressthe writing of DPMEM17 has been forbidden at this time. 
[0030]For this reasonthe comparator 1 1AND gate 120R gates 13 and Hand the 
inverter 15 are formed. Explanation of this operation will input into the relay terminal 
and Q terminal of the comparator 11 read address RA outputted from IDT16and the 
write address WA outputted from CPUIOrespectively. And when the input data of a 
relay terminal and the input data of Q terminal are in agreement (P=Q)a high level 
signal is outputted from the comparator 11. Since high level will be outputted from the 
inverter 15 if the reversal RE is an active state with a low level at this timehigh level 
will be outputted from AND gate 12 despite a join office. Since the output of this AND 
gate 12 is made are inputted into OR gate 13 and high-level [ the output of OR gate 
13 ]the reversal WE is inactive and the writing of DPMEM17 will be forbidden. 
[0031]Nextalthough the memory space of the register of the decipherment device A 
seen from CPU 10 is shown in drawing 3 The area of 64bit x1 where top 6 bits of an 
address (HADD) with a data size of 9 bits were set to "000100" is assigned to the 
initial value table (CBCInitial value table) in the CBC mode. At the time of the initial 



processing performed by the power up etc.the initial value memorized by this initial 
value table is supplied to the CBC mode decoding part Band is set in the register 6. 
The area of 256bit x1 where top 4 bits of an address (HADD) were set to "0010" is 
assigned to the system key table (SYSTEM.Key table). Although these system keys 
shall differ for every systemit is the key fixed in one system. 
[0032]The area of 13bit x12 where top 4 bits of an address (HADD) were set to 
"0100" is assigned to the PID table (PID value table). This PID table is information 
which shows the packet-ized kind of dataand it is referred to as PID which is made 
into a maximum of 12 kindsand differs for every kind of data in one channel. The 
information on a PID table is written in a register predetermined in a system key table 
from CPU10 IDT16 at the time of initial processing. 

[0033]The area of 64bit x12 where top 2 bits of an address (HADD) were set to "10" 
further againlt is assigned to a data key Kse table (Ks_even value table)and the area 
of 64bit x1 2 where top 2 bits of an address (HADD) were set to "1 1 " is assigned to 
the data key Kso table (Ks_odd valuetable). Although the information on this data key 
Kse table and a data key Kso table is written in DPMEM17it is updated by CPU 10 for 
every prescribed timing for several seconds thru/or several 1 0 seconds. 
[0034]Nextthe block diagram showing an example of the detailed composition of 
IDT16 is shown in drawing 2 . In this figure41-52 are 12 flip-flops (DF0-DF1 1) which 
have 13 bit widthrespectivelyand 61-72 are 12 comparators (CP0-CP1 1) which have 
1 3 bit widthrespectively. 40 is an address decoder (ADEC)and if address information 
with a data size of 9 bits is inputtedthe output which activates either DF0-DF1 1 will 
be taken out only to one in the output of 12. 39 is a priority encoder (PE) and the 
address information TMP0-TMP3 combined with TSC information is outputted. 
[0035]In this IDT1 6it is developed by the data size of 13 bits and PID information with 
a data size of 8 bits outputted from CPU10 is inputted into the terminal 30. Address 
information with a data size of 9 bits outputted from CPU 10 is inputted into the 
terminal 32and it is decoded in ADEC40. This decode output is inputted into DF0- 
DF1 1 as a strobe signaland the latch of only any one of DF0-DF1 1 of it is enabled. At 
this timePID information with a data size of 13 bits inputted is inputted common to 12 
DF0-DF1 1 DFO-one every DF 1 1 are chosen one by one by the decode output of 
ADEC40and the PID information currently supplied is latched. Thusa maximum of 12 
kinds of PID information can be latched to DF0-DF1 land a PID table comes to be 
constituted by DF0-DF1 1. 

[0036]PID information with a data size of 13 bits is inputted into the terminal 33and it 
is inputted into it common to B input terminal of the comparators CP0-CP1 1. This 
PID information is PID information with a data size [ of the PID/TSC information with 
a data size of 15 bits which was extracted from the header of the packet which is 
received dataand was supplied to IDT16 ] of 13 bits in the CBC mode decoding part B. 
In this casethe PID information from DF0-DF1 1 is inputted into the generator terminal 
at the comparators CP0-CP1 1 respectivelyand a coincidence signal is outputted from 



the comparator as which the PID information inputted from the terminal 33 and PID 
information in agreement are inputted into the generator terminal. Thereforeif the PID 
information in a PID table is inputted from the terminal 33a coincidence signal will be 
outputted from any one of CPO-the CP1 1. 

[0037]Although this logical table of CP0-CP11 is shown in drawing 4 1 signal is 
outputted when in agreement [ all"1" is not inputted into the generator terminal and 
battery terminal of CP0-CP1 land ] (A=B). "0" is outputted when not in agreement. 
The logical table of PE39 is shown in drawing 5 . In the logical table of this PE39when 
CP2 to "1" signal is outputtedfrom PE39the 4 bits (TMP0-TMP3) data of "0010" is 
outputted. In this PE39as shown in drawing 5 D0 is considered as the input to which 
priority was given mostand D1 1 is considered as the input of the lowest priority. By 
the wayalthough the PID information of the PID table set as DF0-DF1 1 and 
conflicting PID information may be inputtedall"0" will be inputted into PE in this case. 
NK output of PE is set to "1 " at this time. When NK output is "1 "going to read the 
key table of the data key mentioned later is forbidden. 
[0038]Since the level of the terminal 31 is set to "0" at the time of initial 
processingssuch as a power upand all of DF0-DF11 are presetDF0-DF1 1 to "1" is 
outputted. ThereforeCP0-CP1 1 to alf'O" will be outputted in this caseand going to 
read the key table of a data key as mentioned above is forbidden. Since a key table is 
not used when going to read a key table is forbiddena data key can be written in this 
key table from CPU 10. That isinitial setting of a data key can be carried out. The 
terminal 31 is a power-on-reset terminaland the level returns after predetermined 
time "1." 

[0039]Nextthe operation which searchs the key table of a data key is explained using 
the PID information and the TSC information in received datareferring to drawing 6 . 
Suppose that "PID-F" was inputted as PID information with a data size of 1 3 bits 
from the header of received dataand "10" was inputted as TSC information with a 
data size of 2 bits at Step S20 shown in drawing 6 . This "10" assumes that it is 
shown that scramble is carried out with the data key Kse. Subsequentlythis PID 
information is inputted into the generator terminal of CP0-CP1 1 at Step S21and it is 
compared with the PID information stored in DF0-DF1 1. As a resultCP5 to "1" signal 
is outputted and output TMP of TEMP3-TEMP0 of PE39 [3 . .0] is set to "0101." 
That isPID-Fis searched. "0101" which is an output of this PE39 is made into the 1st 
bit from the 4th bit of the address HADD. 

[0040]Subsequently2 bits ("10") of TSC information TSC [1..0] are made into the 5th 
bit of HADDand the 6th bit at Step S22and the address HADD of 6 bit size [8..3] is 
generated. Thereforethe address HADD [8..3] becomes "100101." And if the address 
HADD of "100101" generated at Step S23 [8..3] refers a key tabledata key Kse-F of 
64 bit width will come to be obtained from Ks_even Table. And the decipherment of a 
cryptogram inputted based on obtained data key Kse-F is performed with the 
decipherment device A. Thuswithout preparing the table of 13 bit width corresponding 



to PID informationsince it is considered as the indirect search method which searches 
a data key with the decoding method of this invention indirectlysince what is 
necessary is just to prepare the key table of 6 bit widththe capacity of a memory can 
be reduced and it can miniaturize. 

[0041 ]In this wayin a deciphermentsince only one side of Ks_even Table of a key table 
and Ks_odd Table is usedthe data key of the key table which is not used can be 
updated. As mentioned aboveCPU10 performs thisbut since the timing of CPU10 and 
the timing of the decipherment device A are asynchronous and it operatesCPU10 
goes the data key which it is asynchronous and is updated to write in. For this 
reasonin the dual port memory 1 7 in which a key table is storedthe case where writing 
and read-out are simultaneously performed by the same address as mentioned above 
arises. Although the example of timing at this time is shown in drawing 9 when the 
reversal RE of 8 clock width occurs to the timing to illustrateas mentioned abovethe 
writing of the same address from CPU10 is forbidden in these 8 clock periods. 
[0042] By the waythe case where the same PID is stored in the PID table by a certain 
cause arises. For examplealthough considered as a maximum of 12 kinds per channel 
of PID informationwhen you do not need 12 kinds of PIDit is not necessary to write 
12 kinds of PID in a PID tableand only PID of the kind which carries out necessity will 
be written in it. Thenthe data of the column of PID which is not written in may turn 
into the data same by chance as PID. In such a casesince there is a possibility that it 
may become impossible to read and decode the mistaken data keyin this inventionthis 
has been prevented as follows. 

[0043]As shown in drawing 7 when two or more "PID-F" is shown in a PID tablehe is 
trying for the address HADD of them to give priority to the smaller one. This is 
because it goes to write in a PID table from the smaller one of the address HADDso 
the probability which the larger one of the address HADD has mistaken is high. By 
thisif "PID-F" is inputted as PID informationOI 0001 01 will come to be obtained as the 
address HADD [8..1 processing mentioned above and same processing are performed 
and data key Kse~F of 64 bit width comes to be obtained from Ks_even Table. 
[0044]There may be no PID applicable by the PID information from the header of 
input dataeven if it refers to a PID table. For exampleas shown in drawing 8 even if 
"PID-F" is inputted as PID informationthere is no PID applicable to "PID-F" all over 
a PID table. In such a casea data key is not readwithout going to read both Ks_even 
Table of a key tableand Ks.odd Table. In this caseTS which is input data will be 
outputted as it is. 

[0045]Nextalthough the decipherment flow of the decipherment device A shown in 
drawing 1 is shown in drawing 10 if a transport stream (TS) is inputtedit will be judged 
whether scramble is carried out at Step S10. This judgment is judged by detecting 
whether the flag in the header which shows that scramble was carried out stands. In 
this casewhen the flag standsit is judged with the scramble onand it progresses to 
Step S1 land rewriting of a desired flag etc. is performed here. SubsequentlyPID 



information is extracted from a header at Step S12and a key table is referred to. The 
key table in which host interface processing was performed at Step S16 of key table 
processingand the key table in this case was written in at Step S17 is referred to. 
Processing of Step S12 is processing shown in said drawing 6 . 
[0046]Processing of the above step S10 thru/or Step S12 is header control 
processing. When judged with the scramble off at Step S10TS is outputted as it is. 
Subsequentlydecipherment processing in the CBC mode is performed at Step S13and 
it is judged at Step S14 whether the cryptogram by which decipherment processing is 
carried out is an integral multiple which is 64 bits. When a cryptogram has a fraction 
and it is judged with Nodecipherment processing in OFB mode is performed about a 
fractional part at Step S15and the plaintext by which decipherment processing was 
carried out is outputted. When judged with a 64-bit integral multiple at Step S14the 
64-bit plaintext by which decipherment processing was carried out comes to be 
outputted. 

[0047]By the wayexecution of the decipherment flow as shown in drawing 1 0 is 
performed by the decoding algorithm shown in said drawing 1 8 . Since the decoding 
algorithm shown in drawing 18 is as having mentioned aboveit omits herebut the 
details of composition of performing the decipherment algorithm and cryptographic 
algorithm in a decoding algorithm are explained with reference to drawing 1 1 t hru/or 
drawing 15 . Drawing 1 1 shows the composition of cipher processing which performs a 
cryptographic algorithm. In drawing 11 t he input data of 64 bit width is divided into top 
32 bits data and 32-bit low-ranking dataand is inputted into the first eight steps of 
codes. Eight steps of this code is considered as the composition by which four steps 
of operation stages which calculate a function were repeated twice. And in the first 
rank of the operation stage 20the operation of the function pi 1 is performed to top 
32 bits data and the 32-bit low-ranking data which were inputted. Subsequentlyin the 
2nd stepthe operation of the function pi 2 is performed to the output of the first rank. 
In this casethe work key K1 of 32 bit width is inputted into the 2nd stepand the 2nd- 
step operation is performed using this work key K1. 

[0048]In the 3rd stepthe operation of the function pi 3 is performed to the 2nd~step 
output. In this casethe work key K2 of 32 bit width and K3 are inputted into the 3rd 
stepand the operation is performed using this work key K2 and K3. Thenin the 4th 
stepthe operation of the function pi 4 is performed to the 3rd-step output. In this 
casethe work key K4 of 32 bit width is inputted into the 4th stepand the operation is 
performed using this work key K4. In the operation stage 21 which performs four 
steps of operations which furthermore remainthe operation of the function pi 1 is 
performed to the output from the operation stage 20 in the first rank. Subsequentlyin 
the 2nd stepthe operation of the function pi 2 is performed to the output of the first 
rank. In this casework key K5 of 32 bit width is inputted into the 2nd stepand the 
operation is performed using this work key K5. 

[0049]In the 3rd stepthe operation of the function pi 3 is performed to the 2nd~step 



output. In this casethe work key K6 of 32 bit width and K7 are inputted into the 3rd 
stepand the operation is performed using this work key K6 and K7. Thenin the 4th 
stepthe operation of the function pi 4 is performed to the 3rd~step output. In this 
casethe work key K8 of 32 bit width is inputted into the 4th stepand the operation is 
performed using this work key K8. Thusas for eight steps of codesthe data of a total 
of 64 bit width of top 32 bits and 32 bits of low ranks in which cipher processing was 
performed is further inputted into 22. As for eight steps of this codethe operation of 
eight steps of codes mentioned above in 22 and the same operation are performedand 
the output data by which top 32 bits and a total of 64 bit width of 32 bits of low ranks 
were randomized is obtained. 

[0050]The number of cycles of eight steps of codes is [ number of times of not only 2 
times but a request ] repeatable as illustrated. Output data is randomized highly and 
can make encryption strength a strong thingso that many this number of times is 
repeated, the operation of the function currently performed by the operation stage 
coming out markedly is done to the substitution which transposes the character 
according to a fixed rule to other charactersand the operation which performs the 
transposition which replaces an order of a character. 

[0051]Nextalthough the composition of the decipherment processing which performs a 
decipherment algorithm is shown in drawing 12 a different point from cipher processing 
mentioned above is a point of being made to calculate conversely from the output 
side of the composition of cipher processing. That isin four steps of operation stages 
23 of the beginning of eight steps of codesthe work key K8 of 32 bit width was used 
for the input data in which 64 bit width divided into top 32 bits and 32 bits of low 
ranks is encipheredand the function pi 4 is calculated. Subsequentlyin the 2nd stepthe 
work key K7 was used for the output data of the first rankand the function pi 3 is 
calculated. In the 3rd stepthe work key K6 and K7 were used for the output data of 
the 2nd stepand the function pi 2 is calculated. In the 3rd stepwork key K5 was used 
for the output data of the 2nd stepthe function pi 2 was calculatedand the function pi 
1 is calculated to the output data of the 3rd step in the 4th step further again. 
[0052] Four steps of such operations are similarly performed using the work keys K4- 
K1 in the operation 24. Also in 25eight steps of codes in which the operation of eight 
steps of above-mentioned codes is concatenated performand the output data of a 
total of 64 bit width of top 32 bits and 32 bits of low ranks by which decoding was 
carried out comes, to be obtained. Let repeat frequency of eight steps of codes be a 
repeat count of eight steps of codes performed in cipher processingand the same 
number of times. 

[0053]Nextit explains in detailraising the operation stage 20 of cipher processing for 
the details of the operation currently performed in the operation stage to an 
exampleand referring to drawing 1 3 . In the operation of the function pi 1 of the first 
rankthe high order bit divided into inputted 32 bits is outputted as it iswithout 
calculatingand the exclusive OR of a high order bit and a lower bit calculates itand it 



is outputted as a lower bit. In the operation of the continuing function pi 2 of the 2nd 
stepthe work key K1 is added to the data x of 32 bits of low ranksand x+K1 calculates 
first. Subsequentlywhen x+K1 is set to ythe 1-bit left cyclic shift of the y is carried 
outy-1 is added to the valueand z is obtained. Nextthe 4-bit left cyclic shift of the z 
is carried outand the exclusive OR of the value and z is acquired. This result of an 
operation and top 32-bit exclusive OR calculateand calculated top 32-bit data is 
outputted. In this case32 bits of low ranks are outputted as it iswithout the inputted 
data calculating. 

[0054]In the operation of the function pi 3 of the 3rd stepthe work key K2 is added to 
top 32-bit data xand x+K2 calculates first. Subsequentlywhen x+K2 is set to ythe 2- 
bit left cyclic shift of the y is carried outy+1 is added to the valueand z is obtained. 
Nextthe 8-bit left cyclic shift of the z is carried outand the exclusive OR a of the 
value and z is acquired. The work key K3 is added to aand a+K3 calculates. 
Subsequentlywhen a+K3 is set to bthe 1-bit left cyclic shift of the b is carried out~b 
is added to the valueand c is obtained. Nextthe logical sum for every bit of a and x 
and exclusive OR with the value which carried out the 1 6-bit left cyclic shift of the c 
are calculated. The exclusive OR of this result of an operation and the data of 32 bits 
of low ranks is calculatedand the data of 32 bits of calculated low ranks is outputted. 
Top 32-bit data turns into top 32-bit output data as it iswithout calculating. 
[0055]By the operation of the function pi 4 of the 4th stepthe work key K4 is added 
to the data x of 32 bits of low ranksand x+K4 calculates first further again. 
Subsequentlywhen x+K4 is set to ythe 2-bit left cyclic shift of the y is carried outand 
y+1 is added to the value. This result of an operation and top 32-bit exclusive OR 
calculateand calculated top 32-bit data is outputted. In this casethe data of 32 bits of 
low ranks is outputted as data of 32 bits of low ranks as it iswithout calculating. 
[0056]In the above-mentioned operationby adding the work keys K1-K4 to 
datasubstitution processing which replaces a character in other characters is 
performedand the transposition which replaces the position of a character is 
performed by carrying out the cyclic shift of the data. Thusa plaintext is enciphered 
by the cryptogram by performing substitution and the algorithm of transposition. When 
carrying out decodingit can decode to the original plaintext by performing substitution 
contrary to encryptionand the algorithm of transposition. 

[0057]Nextalthough the composition which calculates the function mentioned above is 
explained still in detailthe example of the function pi 2 shall be raised to drawing 
1_4and shall be explained. In drawing 14 in 1st adding machine Add80input data x and 
the 32-bit work key K1 of 32 bits of low ranks are addedand addition data y is 
outputted. In the 1st left round shifter 81 the 1-bit left cyclic shift of this addition 
data y is carried outand it is added with the output of the 1st left round shifter 81 in 
the 2nd adding machine 82. In the 3rd adding machine 84-1 is added to this added 
resultand the data z calculates. In the 2nd left round shifter 85the 4-bit left cyclic 
shift of this data z is carried outand it is supplied to the exclusive "or" circuit 86. The 



output data of the 2nd left round shifter 85the data zand top 32 bit input data are 
inputted into this exclusive "or" circuit 86and the exclusive OR of three data 
calculates. This result of an operation serves as top 32 bit input data inputted into 
the next step. Low rank 32 bit input data turns into low rank 32 bit input data inputted 
into the next stepwithout calculating. 

[0058] Nextthe composition of the key schedule processing which generates the work 
key of 256 bit width from the data key of 64 bit width and the system key of 256 bit 
width is shown in drawing 15 . Key schedule processing is considered as the 
composition to which one-step cascade connection of two steps and one step of 
operation stage 28 was carried out for four steps of operation stages 26 and 27 as 
shown in drawing 15 . In four steps of operation stages 26 and 27the operation of the 
function pi 1 is performed in the first rankthe operation of the function pi 2 is 
performed in the 2nd stepthe operation of the function pi 3 is performed in the 3rd 
stepand the operation of the function pi 4 is performed in the 4th step. 
[0059]Since such an operation algorithm is the same as the algorithm of cipher 
processing mentioned aboveomit the explanationbut. In key schedule processinginput 
data is used as a 64-bit data keythe operation of the function pi 1 thru/or the 
function pi 4 is performed using the 32-bit system keys J1-J8respectivelyand the 
eight 32-bit work keys K1-K8 are generatedrespectively. Howevernine steps of 
operations are performed on the wholeand it is different from the algorithm of cipher 
processing mentioned above in that the function pi 1 is calculated in a final stage. 
[0060]The top 32-bit output data after the function pi2 operation of the operation 
stage 26 is outputted as the work key K1 32 bits of low rank output data after function 
pi3 operation is outputted as the work key K2and the top 32-bit output data after 
function pi4 operation is outputted as the work key K3. 32 bits of low rank output 
data after the function pi 1 operation of the operation stage 27 is outputted as the 
work key K4The top 32-bit output data after function pi2 operation is outputted as 
work key K5The top 32-bit output data after function pi3 operation is outputted as 
the work key K6the top 32-bit output data after function pi4 operation is outputted 
as the work key K7and 32 bits of low rank output data after the function pi1 operation 
of the final stage 28 is outputted as the work key K8. 

[0061]If the key schedule processing which was mentioned above and which is shown 
in cipher processing shown in drawing 1 1 and drawing 1 3 is referred tothe composition 
of four steps of operation stagesi.e.an operation algorithmis made equaland it can 
perform cipher processing or key schedule processing by repeating the operation of 
four steps of this operation stageand performing it. From thiscipher processing or key 
schedule processing can be performed by repeating an operation core and performing 
itif an operation core is considered as the composition which carried out cascade 
connection of the operation stage of the function pi 1the operation stage of the 
function pi 2the operation stage of the function pi 3and the operation stage of the 
function pi 4 as shown in drawing 1 6 (a). This operation core generates a work key 



from the data key and system key which are shown in drawing 20 and it is equivalent 
to Encryptor which is performing cipher processing in the CBC mode and OFB 
modeand let it be an Encryptor core. In this casethe data keys Ks1-Ks4 and the data 
keys Ks5-Ks8 are supplied to an Encryptor core by time sharing. 
[0062]If drawing 12 is referred tothe composition of four steps of operation 
stagesi.e.an operation algorithmis made equaland it can perform decipherment 
processing by repeating the operation of four steps of this operation stageand 
performing it. From thisdecipherment processing can be performed by repeating a 
decipherment operation core and performing itif a decipherment operation core is 
considered as the composition which carried out cascade connection of the operation 
stage of the function pi 4the operation stage of the function pi 3the operation stage 
of the function pi 2and the operation stage of the function pi 1 as shown in drawing 
1 6 (b). This decipherment operation core is equivalent to Decryptor which is 
performing decipherment processing in the CBC mode and OFB mode shown in 
drawing 20 and let it be a Decryptor core. In this casethe data keys Ks8-Ks5 and the 
data keys Ks4~Ks1 are supplied to a Decryptor core by time sharing. Thusby 
repeating and performing an Encryptor corethe algorithm of cipher processing and a 
key schedule can be performedand a decipherment algorithm can be performed by 
repeating and performing a Decryptor core. 

[0063]As mentioned abovealthough the decipherment device which performs the 
decoding method of this invention was explainedthe electronic equipment of this 
invention is a tunera TV apparatusetc. which are provided with such a decipherment 
device at least. Although the above explanation explained the cryptogram of 64 bit 
blocks as what generates the plaintext of 64 bit blocks using a 64 bits data key and a 
256-bit system keythis invention is not limited to these figures and it can be 
considered as arbitrary numerical values. This invention is not limited to the 
encryption and a decoding method which repeats the transposition and substitution 
which were mentioned aboveand can be applied to other encryption and decoding 
methods. 
[0064] 

[Effect of the Invention]Since this invention is constituted as mentioned aboveit can 
be considered as the decoding method that read-out and writing control of a memory 
means in which the key information for performing decipherment processing is stored 
can be performed appropriatelyand memory control can be performed easily. 
Thereforeit can be considered as the decoding method that all the decipherment 
processings can be performed in real time in a receiver. Since composition of the 
memory control means in electronic equipment provided with the decoding means 
which performs such a decoding method can be made smallelectronic equipment can 
be provided small and cheaply. 



DESCRIPTION OF DRAWINGS 



[Brief Description of the Drawings] 

[Drawing 1] It is a block diagram showing the example of composition of the 
decipherment device which is an embodiment of the decoding method of this 
invention. 

[Drawing 2] It is a block diagram showing the composition of IDT in the decipherment 
device shown in drawing 1 . 

[Drawing 3] It is a chart showing the memory space of the register in the 
decipherment device seen from CPU shown in drawing 1 . 

[Drawing 4] It is a chart showing the logical table of the comparators CP0-CP1 1 of 
IDT shown in drawing 2 . 

[Drawing 5] It is a chart showing the logical table of PE of IDT shown in drawing 2 . 
[Drawing 6] In the decipherment device shown in drawing 1 it is a figure for explaining 
how to search a data key with an indirect search method from the information in the 
header of input data. 

[Drawing 7] It is a figure for explaining operation when PID overlaps all over a PID 
table. 

[Drawing 8] It is a figure for explaining operation in case PID applicable all over a PID 
table does not exist. 

[Drawing 9] It is a figure showing the example of the lead timing of DPMEM in the 
decipherment device shown in drawing 1 . 

[Drawing 10] It is a flow chart which shows the decipherment flow of the decipherment 
device shown in drawing 1 . 
[Drawing 1 1] It is a figure showing the 
[Drawing 1 2] It is a figure showing the 
[Drawing 13] It is a figure showing the 
processing. 

[Drawing 14] It is a figure showing the 
pi 2 in a fundamental function. 
[Drawing 15] It is a figure showing the 
[Drawing 1 6] It is a figure showing the 
Decryptor core. 

[Drawing 1 7] It is a figure showing the 
[Drawing 1 8] It is a figure showing the 
[Drawing 1 9] It is a figure showing the 
CBC mode and OFB mode. 
[Drawing 20] It is a figure showing the 
decoding method. 
[Description of Notations] 
1 Received data2 output data34 switching meansand 5 DecryptorSix registersand 79 



composition of cipher processing, 
composition of decipherment processing, 
details of the fundamental function in cipher 

detailed composition for calculating the function 

composition of key schedule processing, 
composition of an Encryptor core and a 

algorithm of the conventional encryption, 
algorithm of the conventional decoding, 
composition in the encryption use mode in the 

composition of conventional encryption and 



and 86 An exclusive "or" circuit and 8 EncryptorlO CPU and 1 1 An AND gateand 13 
and 14 A comparator and 12 OR gate 15 An inverter 16 IDT17 DPMEMand 20-28 The 
operation stage39 PE40 ADECand 41-52 A fiip-flopand 61-72 A comparatorand 8082 
and 84 [ An adding machineand 81 and 85 ] [ Left round shifter ] 
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GfCjcyftfiBSnTC*. CftlCfcy, 64lfyht1 
^ r Py^trs©#X'6»*2:i:fi<?**«l:5Kft*. 
C B C=E- Kfe«fetfO FBi- Kttrofb&Ml^ 

[0 0 0 7] *fo MULTI2*aKfe^«lS»Mb7 7 ;UdrU 

x^m^ii 8iz^r. hi 8ie^-r<fcdi^ 

6 4 If-y KOr-r ZMK s tC2 5 6 fcf-y hOS'XxAH 
J *fflt^B»7;U JUXA©aW**-rci:lcJ:y 2 

5 6(f<> h©7- 9SKw«£fSr«. £©m^7;U:J 

y XAoaura: B»7;nr u xa *fr#s c iz& y us 

SftS, £jSg**l/c9-?8Kwtt, fi?^7;U=T'JXA 
f K«*&*ftTA*l*ftfc6 4 fcf-y KOBWS: 

^nawbsha. a& 0FB*-K?i*^b;*ftTc 
sure-SB, iw^nry xahs#s g izi*mz ft, 

7-*«Kw*JSiNTiW7;U:jyX£»T#«gfc<fc 

tilery* 1 7'P'^6 4t> r-<D«»S£»H{bLT 

6 4fcTv K0¥X*#*Ciij«T»**. £/c, CBCi 

- Kt*nT^*a^tt, s^i/^yxAH^Sf 

tfC B Ci- KflMHWjWy XA*«rT*J:3fc* 
ft3„ 

[0 0 0 8] EC?, HWfbfiJfflt- KOKBfcH 1 9 
*#HL*#Sfj9tf, HI 9 (a) (CCBCt-KO 
W»fb-j|lttfb©«B««J«*mL, HI 9 (b) KOF 
B^-KroW^b-fifilfbfDHIS^Rg^LTl^o C 
BCt-KTte, H19 (a) fcgiT &oiZ i 
X7Py*M(i) It 8E«lftg?TJllSgl oiteA** 

ft, us?x$ (reg) i 0 3ic£y«ratifci7n 
•> *m®iwx7p v * c o-d ^©sfffiWiisw*^ 

SI 0 2Kfe^7, 7*-*HKs(E»^Tftja*tlfc 

7-^atcd;ypi^b*ti^ z:©m^{bi!rftfci3g 

OWX7ny^C(i) ti. 



CO) = EKs (M(i) . EOR. C(i-1) ) 

te/EU EKs (m) ttm£KsTBg^{bf 
5Ct***LTfey, EORti^ffiWISSSKDiS*^ 

[0 0 0 9] LT, E0Bf9S7Py*C(i) ti&fl 

**u sflifliKfetNTSflisti^ctfca:*. sfltsn 
fcBi^3t7~P'y<7C(i) s?^7;Udfyx/xHS#ia 

1 1 1fcfc^TT-*«KslC»^T£ja*ftfc7- 

^«*ffl^T«iH*ifu m&mm®»-\ i 3tc««e* 
fts„ crosffteMiiSfflia^i i 3icttu>>x* (re 
G) 1 1 2fcfccvnffi*ft/L i7Pv*ta®fl»S 
7Py*C(l-1) #A7J*ftT, ffl#®gH&ttSHD#at 
»*ti«„ £©13, 3<lffl£Sffifi|4)T-«ttKs(i« 
L<, C*iK*y, MWftaftBS&l 1 3frS i#S 
©¥S7Py?M(i) A«*ti5o i#S©¥S7P 

M(!) =DKs (C(l) . EOR. C(i-1) ) 

tctcU DKs (c) ttKsTc*jBBHb-r*E£*jR 

[0 0 10] O F B ^E- KBfTIi, i #@©¥S 

7Py*M(l) U#fi!ittll3iDglBl 0 5fc#»*ft 

s, z.<D$mifimm®m$&i o sia*. f-^tKsc 
»-3i' k T4j«**ifc9-^«t=j:yaJWb*tirciW3» 

/bJyXA«T#«1 0 4©lU»flHWMrtiTl"»«. & 
33, fl»7;UJyXL k »5#«1 0 4<DftjM, UvX 

$ i o 3ic«fcy 1 7py*«B3*iTii»7/u:jyXA 
0 4fclWr*lTl**. snatchy. SPffiWM 
Sffllil^ 10 5^6 ^SLIfclc J: y «HMb**ifeiWS7 
P-y^C(i) tfffl**ti*. 
[00 1 1] ^LT, COIWX^P'>^C(i) li^fi 

fcBi^X7~P>y^C(i) (4, gNSWIiiffllHlKl 1 4|:| 

yX^HS#IS1 1 5K6^Tt-*1KsKI^T 

*iti^o co)ii»7;udryxASifi#ai 1 50*73 

14, Ui>X^ (REG) 1 1 2Kfi^T1 ^Py^HH 
*hTIW7/U:JyXA«?^«1 1 5(CM3-nT^ 
^©Jf^x jlfffiWfSSWlHlKl 1 4lc«|g^^ SSL 

sfwtsawiHi^i 0 5Kflae**i*a»t»L 

<, cn(*:j:y, SfffiMligsffllHlK 1 1 46^6 i #B© 
¥*7T3y^M(i) #»6*i*. 
[0 0 12] tt±KWLfcW*{bfilfflt-K*mr*H 
^1b • jVEmb^S<D«P8«A«H2 0 ic^fo cltDHlc 

e^T, mmmizizzt^yj^i ootrnTLStiTts 
y, x^75>75i ootcjcyATJx-^^x^^vx 

n« 0 gfflfliictt, 7W5v?7i 1 oAwenz 
fey, ca)7W7V7"7i 1 oic&v zt^yJiiz 
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[0 0 13] 10 0B, A***lfeA*x 

-* (TO *«WftT*»»7;UJUXA»3«T 
fc^Encryptor 102L UvX-S* 103^ SH&fttft 
(EX-OR) 1 0 1 frS&SCBC^-KBg 
*fli»£, WJ X^3lfT#S?»*Encryptor 

1 04<t, %ttftlft9nis|B (EX-OR) 1 05frS 

x— ?ii->X7Aii!)S7-: ?«*ft<Sr*Encrypto 
r 1 0 6&7.?5>751 0 0|tyE«jlS*lT^3. £ 
JjE*ftfc7— ?«4Encryptor 1 0 2, 1 0 4tefltt&* 

Encryptor 1 0 2 s Encryptor 1 0 
4, Encryptor 1 0 6ltm—ffil£f£tlT^%<DT\ 1 
OOEncryptor U:J:y 3 OCOEncryptor ZMmtZZt 
CBCf- KB»ft»feJ:tf O F Bi- KBg 

[0 0 14] tfcs 7X^7>751 1 0tt» Xttft 
K"c*353Decryptor 1 1 1 U5>X* 1 1 2 

t, mmtmimb (ex-or) 1 1 3^sa*c 

BCi- KiWBMkSts H»7ju Jy XL>*fr#8?s 
^Encryptor 1 1 5,!:, $ffittltt£R]|a|R (EX-0 
R) 1 1 4fr6£30F B*-K|MMfc*^6*ja**l 

jfrtSEncryptor 1 1 6 t,TX?5 >75 1 1 OftlEfli 
*SftTV5= £ja**lfe7~?«*Deeryptor 1 1 1 
t, Encryptor 1 1 5 (EfltttSfrfi. &fc\ Encryptor 
115, Encryptor 1 1 6 lilsl— MmtitlTl^O) 
T\ 1 OCOEncryptor IZ&V 2 OOEncryptor 
5:iif^5. £fc, CBC^-KjBBHk»feJ:tfO 

[0 0 15] 

LTi2*ao«fc5aas4iw{k-iii«fb*a«, v7h 

mm Ltcm^it. ®«****3^5* ttivpy 7;i/* 

immmm&ym<D?imtzi \- K7 1 TTn^m 
wrasse ticas. L&uk#6« sffffiicas^T 

m-k7i7w\ aoiajiBi^fTdct^s^fflati© 
ics 3 <h i/> a f^h o ft„ 

[0 0 16] *ISfllW:Kfi4flH^fc&3T t X^ 



T'X^5>7VU? tlfex-**, SfflffltcfclNT U 7;U 

#s*«A*'jxffl^osMi5a:«?itB*a«f * c tit 

Sg2©aM£LZV*o 
[0 0 17] 

[Mi*»3W3fca&<J!>#sj ±iBmiro@w=&Sfi!6-r 

»ma*»*ac»*a*x^y7'i, A7dx-**<d 
mMiz£Vi%mztitc^?tifr<Dmmmz. imb/* y 

y T^HaWH* ftfcWt SKB^TMfBA*! 5 s - 2 * 
*trf*»RXxy7'£#6fty, IJE»*ii*Xr*y 
7'OSSIBIHi:. MlBI^ffi U77 TtogfrJBIHttf 
S&ofdf^Ta&oT. B*j£3*7KUX£:§5i^!±iL7 

<7)H^T^^±f 3 <fc 5 [Z LTl^„ 

[0018] st-c, ±iami <z>m*m$,Tztctbi^ 

A7D x- $ zmmtzmmz x * # 6 a y , iuese 
*mm% zt\z& y % tuiBy * y #a*6B8*tij-«i 

1WB*1t-x LTfc y . tWBJSSx - * Ici^S'-r 

[0019] *5ic^fc, ±E»i©a«*afirr*f= 
fete. xmmzzizmcDMmityjmt. imam/m 
mm LTt^y ^ y #a#s, a^t-^+c^t* 

S-5l^TMIBA7Jx-^ 5«fif5i?l7f y 7<hfr 5 

y C 4: «fe y » MSB^ =E y #SA^6 

R*Hl-r«M!Oai7KUX*-9— ^LTSUs MIBJi 

[0 0 2 0] *6tcSfc, ±IBEl(7)gW^ii)5g-ri.fc 
46lc, *f|B^W*6lcffi©rab^>£lis «MBia£*fT 

d«DSBXx>y7<h, y#atc«R©ait«*#*a 

fc«*a*Xxv7^ fflE^ty#S<rS. A7Dx- 
nf ; :S1ffg^uS^^^TBul3A737 = -^^^1-S^X 
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Tfey. fflfflfbJBBrtfcfcl/'Ttt* tf-*LfcttSL R 
[002 1] SSKSfc, ±lEJg2<DSW£5iJ5£-tS* 

s-r**^#a*^ < i t^s «fc 3 t lt^s. 
[0022] c<0*3£*«iii3©isw{b£»te<fcft«r, 

y^ywwEWiicfTdct©?** 

HBBMbSStrscitf?**. Lfcff-sT* SAUK 

fc^T y 7;u^-rL,T-^T©i?Mias^ff 5 c £©?-* 

& y «»#ift©«fi8*«iii{br « z 

7\ «?w§*/j>&fto&ffiHiftr« c ttf <fc 

3KSSo 

[0 0 2 3] 

?**««^«©fliJSfl£iiVr7n y *H*H 1 JfiR 
To COHtfi^T, IMAItCBCf-KOlPR 

imst. oFBt-mmmimct, Ji*<y h i d 
cp i d) T-jjv*mz.*7 > -*wumsiM (i d 

T) 16t, A^x-^ODBWfWcttffl^hfcT— 5«« 
ZMMtttB. C[Z%t73.7l\/#-b**V (DPM 
EM) 17t, DPMEM1 7<Dl=*a*7KUXttt 
*aL7KUXt*jaW*J«Mi(C0MP) 11* 

[0 0 2 4] £M£BA©UI7 1 fcttSflT*-*?** 

y Si* 6 *U A73 * tlfcBWXx - * tt C B C K* 
OFBt-KfctthfclfcHu tJ}g.#S3, fiitfaSS^ 

*4ttfti=Ji?b«c«ysi*s*iT, wxt-^b 

OFB^-K|HWbaJC»EA**tl*. ^LT, A7J 
SftfcflWXx-*^ OFBt- KKHWbWCfcjS^ 

T«wfb* nTTXT-^ffta^ffh*., cb«-k 

SfflHbWB. fc^tfO FBi- KJ»BMb*C(c£^T» 

tMmikTfrzwxutmm-e&Za ae, £©*!£•&? 

BBQ3fc£a?&T-$«i DPMEM17 * 6«*&*ft 

[0 0 2 5] KA±j£*lS§ftx-*©7 
Hi, flfttf I SO/ I EC 1 38 1 8£LT 
SS**lT^*K5>X<K-|*Xf*y-^ (JWT\ TS 



£Ef. ) .hSftSo TSlil 8 Ml 
3S4**iTfeU» ffl5f?4MV h ©Ay #©£<!: £1 8 4 
KO^-f P- Kfl«tt< «fc3K*tiTtV6. «!r5fcv 

fijix 5 - ich r * x 5 -tnE©fca& k/ \° y t -r 

tfttflDSfftT, Cft6<0«SLOXhy-At*tl«. 
[0 0 2 6] COTS^yjfKB/^y htfttfcx- 
*T?«fifc!r*lTl/'3©!&\ S)«T-*-p«Wi*tlTt'»* 
©*>\ *«^ttf6©^-*Tffl|jS*ftT^*©fr*3Vr 
P I DlfSg-¥\ ^fb£*lT^STS&©*§#£ijVf 
TSC (Transport Scrambling Control) 77^fA s t 

ZZtlz&V. El*i6©/\°^-y t-©Htt#JSBIR*tiT^ 
S„ E©B& TSCKJ:yi»Wb*tlT^*tV^yh 

t«HR* nfc»^i4, jgRfbnmrr c tn. < t s * 

&©£&l«mii> jm»A^jfiBMIUl(cBt-2Qn^ 
»L<**i*. 
[0 0 2 7] g=fc, 1o©P I DfcttLTtt* t-*« 
K s e (Ks_even ) tf-^SK s o (Ks_odd) i©2 

LR+fWSfcESf* ft*fcJ6, S«f KHK^3 «fc 5 
-*«©»*»A*ff5!Effl#**C4:» 33«fctf» DIM 
*Wfc(i7*-*«K s e tr-^tK s of*^-©-75 

<t LTv *©T-*««eSf*-*C£ff?*:5#S?* 
So rat>-B. x-^MSBBf-rSEJJKSUassau:?! 

arc bc^e- Kj*flMfc»BKfii*6*iTa3y, cBCi 

-K»RfbWB*6l 5t7 h©x— SJ+r-fXCP I D 
/TSCflMtf I DT1 6lt5SI6*lTt^o 

[0 0 2 8] I D T 1 6 KSLVTI*. 1 3 tfv h 

^>TX©P I DflMH*ffl^TP I Df-7";l/*#HU 
P I Dfr5«ffl*ftfc7KUXflHS£, 2t*7 htr-rX 
©TSClfffit^^b-arTDPMEMI 7C0ilcai7' 
FUXRA (5 s -. $t^XU9bfy h) «£j8LT^ 
So £jS*ftfcRffl7KUXRAttAO«yfrSDPM 
EMI 7©R A*f lCfl«ft**u Z.m\Z 'J - 
7VU (RE) iW^7-f7ttllc65J:?l»L 
Tn R«17'KUXRAJcRar*T-*»&DPMEM 
1 7frSK*HiLTl/>*. R*ttJ*tlfcT-*aK4 % A 

<> *?RD*Sffl73*tlTDecryptor 5{Cflae*ft 
So Decryptor 5tt % «9&Sftfer-*«ts ->Xri* 
SlcSSS->X7 1 Aa*67— ?«*SfiELT» ^fiE? 

*ifc 9 - atj* nfcflwsx- * am m 

WmZfrOo i/7ri«i¥»CPU1 0*6(8 
RSHAlC***lT^*. 
[0 0 2 9] $7fc. CPU 1 Oti^bgUB, CT^g 
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V. »*&«J»£fcW\ 5-rh^*-^/U (WE) £7 

■ii7FUX (WA) ts V<Dt-9V<(X(Ot 
-«<D«t-$ (WD) 5DPMEM1 7teffi|&L 
Tl^o Cffl^ CPU 1 OICttROM^RAMiWB 

-£tf»^j£$tlT^3o &3b\ DPMEM1 7lc7- 

$Mmm*wz&miz. w&t t^xtm-commy 

KUX? I DT 1 6tfr-*«*R*ffl-f J:3lE&-3fc 
«*Hitf ftfcr-i ZtiVF£.£rzZ,z.tfr*>, £ 
<Dmi± DPMEM17 '\©»3r&&£Stlt LTl^o 

[0 0 3 0] ZOtc&blZ, ib^g§1 1 tT> K?- I- 1 
2, *7y- h 1 3, 14, -<>A~ 9 1 5fflt5h 
Tl/>*. C©ttff»IKWr*t. I DTI 6#stna* 
*l3Waj7KUXRAi: % CPU 1 OA^ei±J±l^tlS» 
&7 FWWAitfttill 1 ©P«l?fc<l:tfQ4S?(C 
7LT, PfiS?fl)A*f- ZtQ 
m<D*JlT-*t&-& (P=Q) LfcPftc, J±&§§ 
1 1fr5/H'U'^l/ffl*#fflfl**l*. £<DBf, SCR 
Etfn-U^;l/T-7?x^Xtt<iU:&oT^3<t, -f> 

£37>Ky-M 2fr£/vf U"«/U#tB7J*ft*Ci: 
fcft*. £<D7> K^- h 1 2<DftjM*T?- h 1 3 
IEA*I**IT* *7$*-M 3 <Dffi^J3t^y \-T t * 
*13<D?\ J5fEWEtt#7?7V7'tt<S<h&y. DPM 
EM1 7/\<0»*a*tf»±*ft«Ci:K34« o 
[003 1] fcfc, C P U 1 Ofr6J!fc«RttllA0)U 
S JX*<D** 'J SM«H 3 9 tfy KDr-* 

?-fX©7 KUX (H A D D) <D±ffi6 fcfy htf" 0 0 
0 100" <t:7*-:h.fc6 4bit X10X'J76\ CBCt 
- K0IMM7-7VU (CBCInitial value table ) tc 
*jyaT6tlTl^«. CO«WIMIx-^;KclEtt*ti« 

fiBDMitts «iaftAWte^*h*aj»3ifla«Fte, c 

BCt- K«iBMb»Bfc#HG*hTU3?X4i 6(E-fey h 
*fc, 7KU7. (HADD) <D±fe4tfyh 
00 10" £Snfc2 5 6bit xifiDxiJ7A\ -> 
7TA@7-7'/b (SYSTEM_Key table) [cfjy MR6ft 

[0 0 3 2] SSIC, 7KUX (HADD) <D±ffi4tf 
y V3" 0 100" iiSft/cl 3bit X 1 20XIJ7 
#\ P I Dx-7/U (PID value table ) KM»J3T6 
tlTi/**. £©P I Dx-7;UiM°^y HtStlfcx- 

^ wssarrma?* y , ift v*^?b»* 1 2 a 
stam^-sssHsiEjiasp i D£*ti*. as, 

->X7 1 A^x-7;UiP/f^©Uv'XiS!lc % P I Df-7 
JKDflBlJ* I D T 1 6 tc, U3jMgBf KC P U 1 0fr6 

[0 0 3 3] £SK£fc, 7KUX (HADD) <D±ft 



2tfyhtf" 1 0" £Sftfc6 4bit xi 2<DX'J7 
*\ t— S*^K s ex-7;b (Ks_even value table ) 
ICfjy^TbJU 7KU3. (HADD) ©±<£2tfyh 
tf" 1 1" <h7*-nfc6 4bit xi 2©xy7A\ 7~2 
tKsoT-7)l/ (Ks_odd value table) teliyST6 
hTL^o z:©7™ £®Ks ef-7Jk fc^tfr-* 
■ KsoT-7Jb©flHlliDPMEM1 7fc#*i&$:h. 

a»a^u»i o»oj9f«*-rs>f«K, cp 

U 1 OtE«fcyBR*tlT^«. 

[0 0 3 4] I D T 1 60Bi»H?J?ST 

7ay*H*H2fc^?- 0 COEHEfi^T, 4 1~52 
1*7*17*1 1 3 fcfy Hf**** 1 2 ffl©7 'J y 77 □ 
y7 (DF0~DF 1 1) ?jfcy % 6 1 ~7 2117*1? 
til 3 try MK*r«1 2fi<Dtbl$S§ (CPO-CP 
1 1) Sfc, 4 0«7KU7f ? ZI— ? (ADE 

C) T*Sy, 9tfy KDx— *+M-X©7KUXft«!tf 

A7j**i*i\ 1 2*©aj*«3*a>i*yewE, df 

0~DF 1 1 0l>**ljt^fc7*T4'7*lcT*tti7jtfajS 
*l3„ 3 9ti77'T^y7 1 < -xvn— 5? (P 

E) T-$y x TSClfffl<!:|i*^to*n«7KUXflia 
TMP0~TMP3 tfffl** *i<5. 
[0 0 3 5] CCD I DT 1 6[Cfc^T, 3ir?3 OtCliC 
PU 1 0frSffl7J*ftfc8fcfy KDt-^+M'XOP I 
DlfffiA\ 1 3 fcfy hOx— Sfy--fXlcSg|*tlTA73 
?tX^.„ */c % S?32(C(*CPU1 0A^Sai7]?tlfc 

9 fcfy to>T-*v>(Xox?)?[,juimi*xh*:icu a 

DEC4 0lCfc^TT3-K*n^o CflDra-KlH* 
\tX hO-7ffl#i LTD F 0~D F 1 1 KAflStU 
D F 0~D F 1 lOd-BOf-ftlAMOO^^y^Pr 
tg<!:?nSo A7D*n/£1 3 tf y V0)t-9V 

-fX©P I Dlfffltt, 1 2flODF0~DF 1 1lC±tJi 
ttA7D**lTfcy, A D E C 4 0Ot3- KW*(=J:y 
D F 0~D F 1 1 !b« 1 O^OSS?**lT. 
Tl^P I DflHIff^yySti*. C©J:d^LT. D 
FO-DF 1 1 1C*^1 2SIS(DP I DflM*5y*T 
SeiiA^T*, DF0~DF 1 HCcfcyP I Dx-7VU 

[0 0 3 6] $fc, S?3 3lttt1 3tfy h©T-^t»" 
-TX©P I Dlfffi^A7D**l, J±&S§CP0~CP 1 1 
<DBA7DS?lcSMlCA?3*tl^ 0 H©P I DflHRIi* 
CBC^E- KHIBMbWBlEfi^T, SfltT-*?**/t 
^ry KO'Sy^SafflStlT I DT 1 6(c«aS*tlf= 
1 -5 fcfy hGDx-Sf+H'XcDP I D/T S Clf^<7)5"6 
(D1 3 fcfy hCx-^+MXCP I DtfigT-S^o £<D 
J§&, ib®§5C P 0~C P 1 1 tEliD F 0~D F 1 1 «fc 
U©P I Dl»«fl«*ft?tlA«?tEA***lTfey» S 

?3 3<j;yA73**ifcP i Ditig.h-ij-r^p i duns 

]^A^KA***lT^*Jt«»^6^Sffi^!a** 
ft*. QfoTs P I Dr-^HC»*P I DflHR£(l|? 
3 3fr5A7D£*l3£, CP0~CP1 1 O^^tuEM 
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[0037] c©cpo~cp 1 \<»mmm:m*\ l z.m 

tt\ C P 0~C P 1 1 <0A«?fi«fcWB«B?K*- 

;u" i" tfAAStL?kvkkM3i& -stLfcs? (a= 

B) \z" 1" fflWtffflflSfta. -&LTStM$ 
tt" 0" fl«ffl***l4. £6K, PE3 9<DliSa^E 
COPE3 9©iiiagtct5lNT, fldjltf, C 
P2*6" 1 " •fi^i±i^5-tlfcBt«, PE3 9*6 
tt" 00 10" ©4tfy h (TMP0~TMP3) ©7 
-^tffflTD^ft^o SlOP E 3 9f«H5tc^t-J:5 
fc, D0^fttffi^nfcA7J<f:?n> D1 1tf»Tffi 
©ffi5fcJt©A73<fc£:h.£„ <hiI5T\ D F 0~D F 1 1 
teRSSftft P I Dx-?VUDP I DflWRt-aua^ 
P I DflHHtfA***l*C E©»£fcttP 
Efc*- ;U* 0" tfAaStlSEtfcaS. £©Bt, P 
EON KHB7J*" 1" tts.^ fcfc, NKii7Jtf" 1" 

[0 0 3 8] 2= ft, «;MSABf^(DiaiSSttSBtk«? 
3 1 <DU^;l/*V' 0" i&tK D F 0~D F 1 1 
yj-b-y l-£;h.3;:i:*6, DF0~DF11*6" 
1 " tfffl*J**l*. foT, ZtDmSlt C P 0~C P 1 
i*6*-rt/" o" tfiltfj*;h.*c£fcfcy* ±£E© c fc 

&3b\ i!7-:?VI/&I^KfKC<h*^±7^HT^ 
§l7-?VUtfffiffl*;|tS^©7\ £©817-7 

mzcpu 1 o*ST-*«*»*at» c^tf?**. 

7-2SI©Ml!lS££T3£<!:tfTi5r3 0 $ 
ft, S?3 1 te/\ 0 9-*>U-try h«?-?Sy, F/f^Bf 

rattle*© u^w** 1 " immtZo 

[0 0 3 9] WZ. g«x-^*©P I Dlfffii:TSC 

B 6 Lfttf SKE* *. H 6 iC/Txf X7 y 7"S 2 
0KT, gftx— ?<7)^\y^6 1 3 fcfy |-©r~ *1f 
-<X©P I Dlf?S<!:LT" P I D-F" *\ 2 tfy h© 
x-^^-rXOTSCItffliLT' 1 0" tfAflStlft 
tT*. CO" 1 0" tt, T-*iKse?W5V7 

1 1cTCOP I Dlf|gttCP0~CP 1 1© 
A^KATD^llT, D F 0~D F 1 1 Ic^JtlT^ 
*P I DIUfflfcttRSft*, CP 5*6" 

1 " ff^tfttiTJ^ft, PE39©TEMP3~TEMP 
0©tb73TMP [3. . 0] 6\ " 010 1" <!:&;5 0 
*-ft*>5* " P I D-F" <j«1t-^*tl*. C© % PE 
3 9©ffl*-p»** 0101" ti, 7 FU7.H A DDC 

i4t*7 h*s*i tfy f^sti*. 

[0 0 4 0] Xx-y7S2 2tCTTSClflST 

SC [1. . 0] ©21fy h (" 1 0" ) tfHADD© 
JB5 If y h * 6 tfy h<t?ttT, 6 try h^-fX©7 
KUXHADD [8. . 3] tfSEJ^tl^o Lft*o 



T, 7K1/XHADD [8. . 3] 14* 100101' 
<fc£3o f LT, X7y7°S2 3KT, 4ffi*tlft* 1 
00 10 1" ©7KUXHADD [8. . 3] lz£VM 
T-ZTlbZmmrZt. Ks_even Table *66 4fcTy h 
^©x-^aKse-FAMfStlSiaitS^ *L 
T, m Stlftx— Sf@K s e - F KB^TAJlSflft 

*»B©^b£S?ttllM«fc r - *«*WKr * IB 
SttSIE&Sd: LTt^©T\ P I DflWKEjft&T« 1 3 
tTv h«Dx-7;U*fl3*-r*E£&<* 6 tfy hfi© 

[004 1] &3b\ C©J:3KIH(«fTliif-?;W) 
Ks_even Table , Ks_odd Table ©— *L4MS6ffl**l4 

5Ci:*T*«„ Ihlt fuSELftJ^KCPU 1 0* 
»tT£*)\ CPU10©^< = >^(BiiIA©^ 
^5>*£tt#lffl(BT*IMW-*©T\ CPU1 OttMIQ 
MTMSTTSx-^gl^tjA&KfKo £©ftA6, M 
x-7';l/©l&Srt*tl«f f a7;U?K-hp< : E'J 1 

7KUXTfTfc>tL3Ji£*£L:3©T-253o Z©B#©£ 

f s y<fm*m 9 ^^-r*\ Havr s * -r 5 8 * 

9WMl£l3\.*Tlits MiiLftJ:5^CPU 1 0*6 ©IB 

-7 Kux©»*a*#st±**i«. 

[0 0 4 2] fii6*©Jl rE aK«feyP I Dx- 

xwr, i ^+v*;uay«*i 2g^©p i omts 

tlZtfis 1 2@i!©P I DtjgSRtLfttMi&ttP I D 
x-?'yl4ctt 1 2SH©P I D«»*atj0»(i!a:< % 

«es*-r*affl©p i omf^m^tsztizts^ tz 

t, »#jX$*lTt^^P I D©ffl©x— Jt*ffi»SP I 
DiBHi^-^Kascitf**. iI©cfc7Sli-&lc 

[0 0 4 3] BmciRTJ^fcP I Dx-^;Wc«» 
©" P I D-F" *S«Jg^tt, ^©rt©7KUXHA 

KUXHADD©/J^t^*6P I Dx-7;Un**ii 
^l^S< ©T\ 7 KUXH A D DCD^fL^^oT^ 
5«*3(j«K^*S?S«. CtlltJcy, P I DlffBiiL 
T" P I D-F" tfA**ft*<t» 7KU7.HADD 

[8. . 1 ] <t LT" 0 1 0 0 0 1 0 1" tffi 6^15* 
5K4*J, «aLft«Bli:IW«©«BIi«Tfetu Ks_eve 
n Table *6 6 4tfy hKD7-«|K s e - Ftfffl 6 

[0 0 4 4] ^fcs A73T— 5?©^\y^*6©P I Dlf 

rnzzv, p i Dx-^u*#BauTti»a-r*p i d 
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®£LT" P I D-F" #A7J*ftT*K P I 
iWlZlt" P I D-F" izm^tZP I Dtf&lA, CO 
£5 ti, «x-7jU©Ks_even Table , Ks_odd 

Table ©l^fcHaWcfKEtaSK. x-^HSR 

[0045] jmc, m 1 icsrjBw««A«MHi7P- 

«H10(£S«rtf, b-^yZtf-hXh'J-k (TS) 
tltcZt Zmt^ y 7 5 WiL oT^5 

«m-r«ci:iEj:y!pjs*n*. cosre, -p=>Wu. 

oT^3^ttX*5V7;Uon£«£S*lXx Xt7 
7S1 Hc3i3K CCTflfa077^fffl»*ftAfl«fT 
&l^T% Xx-y7S 1 2fcT'Vy#fr6P I D 
W^Siaj^tiT, c©i§S 
flWiT-^;Utt» «x-:?/W0a©XTy7*S 1 6KT 
*X^>*-7x-X«J1jWj*>*iT, Xxy7S1 

[0 0 4 6] J-X±©Xxy7S 1 0&l^LX7 1 y7S 1 
2©«fflff'Vy$fay|«n-7W0a-W53 o fcfe 7.x 
y7S 1 0KTX?5>7;Uo f f t*!IS**lfcJidK 
lis TStt*OS*ffl*Sft*. 7tv7S1 
3 ICT C B C K©«Hffi3tffito*U 7.x y 7S 1 
4 fcTlBBBflS* tl*fl»*tf 6 4 tfy h<OffiSffi£^ 
frtffflfcSti*. K*£(ciHRtf**J N o 
»£tt, Xxy7S1 SfcTHWHHEOlvTOFBt 
- KOHHiQStffTfch, *RJOSSftfc¥Xtf 
ftS„ Xxy7S 1 4teT6 41fy hOBttflS^: 

!ii7D7!r*lSJ:5l;:&S„ 

[0047] tC5T', Hi 0Kjp-rJ;?&jgf5!7n- 
©Hfftt, MIBH1 8fcijVf»iBWb7;l/J'JX£fcj:y 
*fi**l/*V*. B1 8fc^T»BHl57;l/:JyXA(4ffl 

;U J'J X£*>©»K7;I/:JU X*J3 JU X 

^**(fr««l«fl!)BIB*H 1 Ift^LBI 5*#!ML 
TBKBf*. HI U*B»7;UJ'JXi»**fi-r*li|* 
«H10«ia«w-ro HI Htfc^Ts 6 4fc?yMB©A 
7Jx-*«\ ±fi[3 2 Ify KDx— Sr£Tffi©3 2 tf y 
h ©t-* K»ffl* tlT»«3©B» 8 8fc A7J**lSo 

c ©iw 8 Hft©s**fr 5 4 mom®.-® 2 ® 

mWZtltcM&LtZtlZ. *LT, A7J73rftfc±ffi3 
2 try h©7*-*£"Rft©3 2 tfy h©7-2U:, ;!I1E 
S2 OflDloaicfe^THRTr 1 ©3llHfl**:h.* D 

« 2 R|c&^T«ROtUAlcMR7r 2 ©3l»fl«tt* 
ftS, C©«£, «28fcl4 3 2tfySII©7-7«K 



[0 0 4 8] SSfo «3SIc61^*2SM)HIAIlB 

aw 3 ©auitfiisfts. zamti> m 3 ski* 3 2 e 

yHS©7-7«K2. K3#A73**U £©7-<?gl 
K2. K3*ffl^THJHWrtWlXTt'»*. Hl^T, *4 

smelts 3 mcomtuzmmn 4 ©amtfirctis. 

C«a^s ft4HKtt3 2£y MM>7-9HK4#A 
73**U E©7~ >HK4»ffl^T«JHWffctlTt> 
So *Sfc»*48©3t»£ff5i**a2 1 Kfc^T. 
»WS2 0#S©ffl7Jte*J»fcSl/»THttir 1 (Oatff^ 

ss^tiSo o^t, «2SKfi^Tioa©aj*ncHa7T 

H©7»7«K5tfA7J;M'U C©7— 7«K5*ffl^ 
[0 0 4 9] *Sfc» »3a(Cfet%T»2S(0aS*lCH 

*/r3©aiii3B%*n* 0 zoms. 1138^*3 2 tr 

»HI07-»K6, K7tfA***l, E©7-*H 
K6, K7*B^TWWfitotlTl^6. Ml/»T» S§4 

£©«£. m4SlCli3 2t;'-y hti©7-^aK8 6^A 

CCD <fc 5 LT smmm<Dnt>nTc±iii 3 2 fcf y 
K Tfi3 2 bi'<y h<D^tt6 4 b?y hfiOx— * 
Stfl»8a2 2KA7J**l*. C0Bi^-882 2tefc 
l^T. ±3!LfcBf^8|g03l»<!:[5ia©>1l» 1 i]5gS-^ 
T» ±ffi3 2 tfy h N Tffi3 2 tf y h0^tt6 4 tfy h 

[0 0 5 0] ft*HSLT^*J:3fCs Sf^ 880^31 

u»(*2Ei(cH6f, wa©ia»iiyig-rct<j«T»* 

S„ C0|alR*£<*&yiET«£s ffl7DT-*(*KfilE 
tlTl^So 

[0051] Juxi*€jtfi-r*i»BBe 

<D4®Omn®2 3 tCfe^Ttts ±&3 2 t*y h .hTfS 
3 2 tfy HciHRIShfe 6 4 tf y hllO^k^tlT^ 
SA7Jx—?^ 3 2 Ify MI07-78K 8«ffll^T 
H»7T40aOI*ttLTl^. m2SStc33LN 
T, ?DSa)tl3737 :1 -^lC7-^aK7^ffl^TPa7T3 
flDSWMEHLT^*. *6»=» *3Satcfe^T, S2 
&©ffl7DT f -$rfc7-"7*K6, K7*ffl^TH»rr2 
©SJISttLTL''*. *6K*fe«3SBKfe^T» K 
2S©aj73T-*K7-^«K5*ffllNTH»ir2©ai 
»*»U H4«B(=fe^T» «3S©ffl7DT-*fcH 
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[0 0 5 2] E©«fc3fc4BM>aHJKfc jl»2 4tCt5^ 

±ELfeB»8aoaWfl«l8«*hT^*IW8« 

2 5K33l^TtJl*T**lT, «WMk*nfe±ffi3 2tT*y 
K Tffi 3 2 tf -y h©lt6 4 tf-y m©ffl7J7 ? -$ifl& 
SftSJ^fcfc*. &3b\ rft98&©WJ£L!a]ft& 
B§*§-flHIlCfcl/>T*tT* tlfcBg^ 8 »©«£ LEBStG"] 

[0 0 5 3] 3Wia?fTfctlT^«*J|fl!)B»* 
"494Q3©2ft]|&2 0£fllE±tfTB1 1 3*«BUf*# 

sicsMBicBwrr*. aaoHRwi ©awrptt, atj 

**lfc3 2 lf«y K=«il*hfc±ffiey Mi, 3«?**l 

©SM6WWEfD!(j«3W*tlTTffitfy h<h LTft7J**i 
3. «<» JB2aOB8«7T2fl!)ai||7»(4» Tfi3 2^ 
K)f-*xK7- ?8tK KMB||*tiT, x + K1tf 
St* at»*tl*. x + K1fyi LfcWlC, y 

* 1 \£v hfi»EI5/7 h U f-CDffilC y - 1 fcifflgL? 
z£t#*„ *f£, z€4kfy h/SSrsh>7 hU *<Dm 

20 h<D%mwmmmtfmmnz, mmztitc±iz 

3 2 If >y h©T-*tfai***l». £©»£» Tffi3 2 
tf>y HiA7J**lfcx-*6\ *»*n*E£fc<*© 

[0 0 5 4] $7c, ^3aOHH77 3©3tj|T*tt, ±ffc 
3 2tf-y h©r— 5?xlZ9— ?8K 2 tffiPlf**n\ x 
+ K2jbW3?lf**l*o &l^T\ x + K2£y<!:L/j: 
BKU y52tfyhSffl->7hU *©ffiey+1* 
MJILTzfcffS. 3Wc z?8t:7h£ffl->7h 
U ?©fl£z£©^tttt3ffia£ft3. *SK, a 
£7-*«K3tfi]|]J|*ftT* a + K 3 #301**1*. 

a + K35bi LfcBftc, b * 1 fcf<y Yfflm 
->7hU fOl[c-baiLTc?i§ 0 a 
txOt* h«©WBBi:» c*l 6tf-y hffig05>7 

Tffi3 2 fcfy h©T-$^©SHB«I«l»*a«L 
T. 3Sg**lfVFfii3 2tf«y K©t- $*ftl3?Zo ts. 
fc\ ±ffi3 2tf-y h©r~?lis 31***1* C**< * 
©£$±{£3 2 If -y hOUS^x-^i&So 
[0 0 5 5] *6KSfo M4£©H8;r4©air? 
tt, Tffi3 2 tf>y h©T-* xlE7-*«K 4»I? 
*IT. x+K4Mfl»?*i«„ *tv?» x + K4£ 
y <fc LfcBflc, y52k*7 h£«Hl->7 h U ^OfillC 
y + 1 £J)P*t*o £©31*16*4:, ±ffi 3 2 tf -y h© 

^«iiJi»#ar«***iT* aw**ifc±tft 3 2 tr? h 

Of- ?#ai7J**l*a £©«£. Tffi3 2lf>yh©x 
-*B3W*ftiCi:4<» *©**Ttt3 2i;yh© 
x-*<hLTatt>**i*o 

[0 0 5 6] ±BaW(Cfe^T» 7—?SlK1~K4:& 



#"WXfcii»fb**i3. Sfc* fl?f^bt*Jf£ie«\ 

y ^©^xksite-t * c t # 

[0 0 5 7] *K, ±J2ELfelHllt©ail*ff3«fifi** 
StEPMBtcKWf*^ MKir24)ffi|*rfl1 4fc±tfT 
KEf**.©***. HI 4Kfe^T» JSIftDlHgAcI 
d BOKfil^, Tffi3 2 fcfy h©A7Jx~ 5* x t 3 2 
tf-y h©7—7«K 1 itfjll?^ SP*t— SJy^tiJ 
7J**l*o E©iin*T-*yttWi;ai[al5/7*-8 1 
fcfcivn tf-y h£5Klal->7 h**i*<h£U:, M2J]P» 
B8 2fcfeivr» SfH£MlEh>7*--8 1 ©ttJ7D<LJ]P* 
**i*„ C©jW«SSl«:«31iPWB8 4KfiL>T- 1 
JJP***IT, f-*ztf»»*hi. ECx-SzfcHS 
2£m®i/7$-8 5(Cfc^T4tfy hSi!ls]->7 h* 
*i*iftlts SffteWiiS?PlHlK8 6lc«^**i*» c© 

Sf«fiS?P[ElK8 6tC(im2SiI[s]->7^-8 5t3DJU 

**l. 3 0©x-4r©Stfl!lWlfHSPtfaW**lS. C© 
StmSSB. «»K:AJD*ti»±ffl3 2 bfy hA7Jx- 
^i^*o $fc, Tffi3 2fcf'-y hA73x-^li. 
*l*Cta<*a(EA73**l*Tffi3 2 bf y hA7Jx- 

[0 0 5 8] 6 4 fcf y KB©?-*** 2561:' 

>y h*i©->7xA®fr6 2 5 6 kf'y f*(i©7— f «*4 

>r~/3.-)\,Wmm 1 5tcSfJ:3(c4S©'3IIIS2 
6. 2 7tf2St, 1S©3W«28tfiaiSWt&l9E* 
*lfc«Jt<!:**lT^*o 4S©3IKCa2 6, 2 7 

Kfc^-o*, mmzte^Tm&Tr i ©siifH«Tto*u 2 

as (Efe^TBRir 2 ©aJWffbtu 3 a@ ICfcl^T 
MRir 3©30liWTto*u 4aafcfet"»TH»7r 4 ©31 

[0 0 5 9] C©J:3a3IJl7 , ;UdryX^(4, MizELfc 

pwarac^udr'jXAt'ffji;?**©?*©^!*© 

»St*A\ •X4r3?a-;W0Jfi(Efe^TI*, A73t~^ 
#6 4 tT-y h©x— 5t@i**u Zft?ti3 2 tf-y h© 
•>XfiiJ 1 ~J 8*JBlv?MR7r 1 ^InL^Stt4 
©«KWf*>tlT» 2 e-y h©8 0©7—7 

■ K1^K8#fejS*ftT^*. fcTcU ^ftT9a© 

5 MSE L fcK»»a©7/U J U XA <h fflS LT ^ 

[0 0 6 0] fcfc\ 3f*a2 6©^lif7T23l*m©±te 
3 2 fcT-y httJ73x-^#7-^^K 1 t LTtti 73**1. 
H»7r 3»**©Ttt3 2 If -y httJ73x-^#7-^ 
K 2 t LTtH73**l, BBiStrr 4SH»ft©±(fl[3 2 If -y h 
tti7Jx-^#7-7^K 3 1 LTffi7J**lT^*o *6 
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IE* 8WS2 7<DMmn 1 3HI8M)Tffi3 2 tfy bftj] 

<D±te3 2t£>> bliit>T—5ift r 7-<7MK 5 tLT&Jl 
**U H»n' 33M*0±ffi3 2 If -J> 
-7SlK6<!:LTa}7J*tl. Miit7r4;!W£<D±fii3 2 

\~^9-^m-^mvi 7 i LTi±j7j?ti, 

«2 8<D(ii)[7r 1 «JMM)"Fffi3 2 bf* r-fcrJ7Dx~5*tf 
7-?g|K 8 £ LTttJ7J**lTt^c 

[0061] ±atrc> n 1 1 izmt sgmmtrn 1 3 

y, e:o4aoawa<)!)aiii*iiyiELfT5ct(=«i: 
y> nwfflassfttMx^-^a^wira^fT-rsc 

Z\<DZ.tfr5, aH»37*H1 6 (a) IC 
«r«fe3(z, B9«7r1«!>3tm H«tt 2(0aiirBL US 
mn 3 HSifc/r 4 ®afta«tt«t»M Lfc«fiB 

trtiw, *»a7*iiiiELitfi-r*ci7?s areas 

£«#S7-*«*£iB*-*£&fc % CBCt-KJsJ: 
tfO FBt- KTBi-^jiS^T^Tl^Encryptor Kffi 
SU Encryptor UZiTTtlSo C(Dl^ Encryptor 

□ 7tc(ix— s 1~Ks4if-S!iKs 5~K 

[0 0 6 2] HI 2*#BBr*i:» 4®©5lgg 

Tfcfe-saWR'judry x^tt* L < * fiTfc 

mmmm=i7zmi 6 (b) tc^-rj:aic, ^arr4<D 
1 o3wa««mfiffiLfe«ijs^-rn«. mm**? 

&3b\ C©litt«Jta7l4» BUotcgtrcBC 
: E- Kfiitf O F Bt- FOWmWmZfi-oTVZDecr 
yptor lEffi^U Decryptor □ T'^tlSo Z<0W&* 
Decryptor ZlTlZltT— ZMK s 8~Ks 5 4f- £S 
K s 4~K s 1 .hiWIiJ^^nSo £<D<fc5K, 
Encryptor 3 7£$il LUfff 3 C <h lc «fc y St^ffiSfc 
«fcUWX^^a-;U07 , ;Hf'JX^*SI?T-r*CtffT 
3\ Decryptor ziT^mMLMnt^Ztlz^^mmT 

jury xuzmmz zttfT-zz, 
[0063] jw±* *fm«inifis«»«inn-«inR 

3>IIiT6^„ W±fl!>BWI?tt6 4tfy|»7' 

□ v*©IW£*6 4tf'y HOt*-**. ^2 5 6 
fcT\y hOS/XxLJItffl^T 6 4 fcT'j/ h 7P ■> 



So 
[0064] 

strscttf?**. l/cA^Tv gftijicfc^ry 

r **B«#a*fii7{.*«?aBncfett * * * 
y tt«#ao«i8*/|x* < t s z. t &T~%z<DT\ 

aK'J«*ra&M3Mt*-« E t 7* S «fc 5 tcft 

So 

[0 1 ] *9Bn<0«iRfb^£(D$tt(D^ag?£«j!¥B^ 

D93] H1 ic^f CPU^6ftfe»iBI«(EfeW«U 
[H4] H2(C^T I DTcDibKSCP0~CP 1 -\<D 
[H5] H2JESn DTOPE<0«ra«*^-ria*T? 
[H6] H 1 JE^r»tt HKKfclXT, KllT-tOss 

[E17] P I Dtt-TWIEP I DAMSLTl^if^ 
098] PI Dx-^UflEBEa-TSP I DjfNJttL* 
[139] 01 fca?TflnHMK&*«DPMEM«>iJ- 

im 0] HiK^-r»tt««<o)!iR7P-*a?-r7D 

[011] ffl9ttS®*U$«/7rB|-?&£. 
[HI 2] (B^iSaSOSIfig*^fHT'*«, 

[hi 3] ^®miz&vzm*Mm(DmM*mtm? 

[HI 4] S*Hft4)®Htt7r2$3tlFt-SfcA(l!)iMII 
^IfiE^THT-SSo 

[01 5] mx<rz?i-jmm<Dwm*ffiTmT'&z>o 

[01 6] Encryptor UTt Decryptor 37©Wfig*5^ 
fHT-^So 

[017] «e*©Bi^b©7;nryx^*s-ria?* 

So 

[H1 8] &XOmmik(D7l\s3'JXkZ7jkTm-?35 

So 
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[HI 9] CBCt-KtOFB'E-KOBWflSPJJB^ 

1 gflx-*, 2 ft*}?— 3, 4 «J'JJJta.# 
a. 5 Decryptor , 61/^, 7, 9, 8 6 SHfi 



SDiiSffllHlSS. 8 Encryptor ,10 CPU, 1 1 
IttHHk 12 7VK^-K 13, 14 t7f- 
k 15 -f 16 IDT, 17 DPME 

M, 2 0~2 8 39 PE, 4 0 ADE 

C, 41~52 7U-y7"7P'y7', 6 1~72 tttt 
§§, 8 0, 8 2, 8 4 J)P»g§, 8 1,85 £M®-/ 
72- 
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mmW-9-2 1 2 0 9 0 



: Initial value t 



SYSTEM_Key table 



Ks-aven value table 



-B ( MBia I 1 ' l'Bttl 
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«K1 ( 


32b 


i t 


«K2 ( 


32b 


i t 


®K3 ( 


32b 


i t 


SIK4 ( 


32b 


i t 



■ K 5 ( 3 2b i t ) 
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